Amazon is responsible for making a reasonable effort to prevent anyone unauthorized from doing anything to an account. Swap "shut down" with "read personal information tied to account" or "upload a heinous webpage to the AWS server," whatever.

This is not one of those "by any means, achieve the ends" type scenarios.